Subject: [Privacy-pass] Fwd: [messaging] Issues in Schnorr DLEQ proofs

From: Nick Sullivan <[email-masked]>
Date: Wed, 8 Jan 2020 16:40:20 -0500

Hello folks!

Cross-posting this from another mailing list since it seems to be of
interest.

Nick

---------- Forwarded message ---------
From: Jeff Burdges <[email-masked]>
Date: Wed, Jan 8, 2020 at 2:51 PM
Subject: [messaging] Issues in Schnorr DLEQ proofs
To: <[email-masked]>

I’ve started some approachable notes on issues in current specs for Schnorr
DLEQ proof protocols at
https://github.com/w3f/ring-vrf/blob/master/papers/vrf_issues.tex

I have not yet checked if implementations of either V(X)Ed2551 or Privacy
Pass correct the cofactor spec bugs.  I have not yet either added all the
references for the protocols being commented on or ported over all the
reverences for the non-cofactor concerns from
https://github.com/w3f/schnorrkel/blob/master/src/vrf.rs either.

Jeff

_______________________________________________
Messaging mailing list
[email-masked]
https://moderncrypto.org/mailman/listinfo/messaging

---

From: Alex Davidson <[email-masked]>
Date: Wed, 8 Jan 2020 17:31:21 -0500

Had a quick look, I think this is something that needs to be better handled in
draft-irtf-cfrg-voprf. The draft currently only assumes a prime-order group so
we don’t really have access to the cofactor. However, we should make it clear
exactly what we expect of the group that is being used in this draft (including
how cofactors are accounted for).

I'll create an issue at https://github.com/cfrg/draft-irtf-cfrg-voprf/ <https://github.com/cfrg/draft-irtf-cfrg-voprf/> to track
this. FWIW, the Cloudflare implementation uses P-256 (which is a prime-order
curve), so the attack does not apply.

Alex

> On 8 Jan 2020, at 16:40, Nick Sullivan <nick=[email-masked]> wrote:
> 
> Hello folks!
> 
> Cross-posting this from another mailing list since it seems to be of interest.
> 
> Nick
> 
> From: Jeff Burdges <[email-masked] <mailto:[email-masked]>>
> To: <[email-masked] <mailto:[email-masked]>>
> 
> 
> 
> I’ve started some approachable notes on issues in current specs for Schnorr DLEQ proof protocols at https://github.com/w3f/ring-vrf/blob/master/papers/vrf_issues.tex <https://github.com/w3f/ring-vrf/blob/master/papers/vrf_issues.tex>
> 
> I have not yet checked if implementations of either V(X)Ed2551 or Privacy Pass correct the cofactor spec bugs.  I have not yet either added all the references for the protocols being commented on or ported over all the reverences for the non-cofactor concerns from https://github.com/w3f/schnorrkel/blob/master/src/vrf.rs <https://github.com/w3f/schnorrkel/blob/master/src/vrf.rs> either.
> 
> Jeff
> 
> 
> [email-masked] <mailto:[email-masked]>
> https://moderncrypto.org/mailman/listinfo/messaging <https://moderncrypto.org/mailman/listinfo/messaging>
> <signature.asc>-- 
> Privacy-pass mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/privacy-pass